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Quantum key distribution with decoherence-free subspaces has been proposed to overcome the collective 
noise to the polarization modes of photons flying in quantum channel. Prototype of this scheme have also been 
achieved with parametric-down conversion source. However, a novel type of photon-number-splitting attack we 
proposed in this paper will make the practical implementations of this scheme insecure since the parametric- 
down conversion source may emit multi-photon pairs occasionally. We propose decoy states method to make 
these implementations immune to this attack. And with this decoy states method, both the security distance and 
key bit rate will be increased. 



PACS numbers: 03.67.Dd 



I. INTRODUCTION 



As a combination of quantum mechanics and conventional 
cryptography, Quantum Key Distribution (QKD) HIIIIHI], can 
help two distant peers (Alice and Bob) share secret string of 
bits, called key. Unlike conventional cryptography whose se- 
curity is based on computation complexity, the security of 
QKD relies on the fundamental laws of quantum mechan- 
ics. Any eavesdropping attempt to an ideal QKD process 
will introduce an abnormal high bit error rate of the key. 
By comparing subset of the key, Alice and Bob can catch 
any eavesdropping attempt. Polarization and phase time of 
photons are the most common coding method to implement 
QKD. But, birefringence in optical fiber may depolarize the 
photons, which makes the polarization coding unsuitable for 
QKD based on fiber. Phase time coding is commonly used 
for fiber QKD. Using "Plug&Play" [3] or Faraday-Michelson 
interferometers ! 1 ill . phase time coding can be free from polar- 
ization fluctuations due to birefringence of optical fiber. How- 
ever, "Plug&Play" may be vulnerable for Trojan attack. And 
for Faraday-Michelson interferometers Hill , it's very sensitive 
to phase fluctuations from arms between Alice's and Bob's 
interferometers. To overcome this problem, active compen- 
sation which makes the system more complicated and uneffi- 
cient is used. 

Alternatively, Walton et al. [4] proposed a novel QKD pro- 
tocol based on decoherence-free space (DFS) and Boileau 
et al. [5] developed this scheme to use time-bin and polar- 
ization for encoding. In Boileau's scheme, Alice can en- 
code her qubit in the two-photon states as follows: \H)\V), 

\V)\H), {\H)W) + |V>|fl»/V5, and (|fl>|V> - |V>|fl>/ V2, (in 
experiment by J.-W. Pan [6j], the four states are: {\H)\V} + 
|V>|#»/V2, (\H)\V) - |V>|//»/V2, (\H)\V) + i\V)\H))/y/2 
and (\H)\V) - i\V)\H)/ V2), where H(V) means the horizon- 
tal (vertical) polarization mode of photons. The two photons 
are distinguishable by a fixed time delay At p , which is known 
to Alice and Bob. Then Alice applies a time delay operation 
to the V photons and before Bob detects the two photons, he 
applies a same time delay operation to the H photons. Fi- 
nally, Bob detects the two photons in the \H)\V), \ V)\H) basis 



or -±(\H)\V) + |V>|fl», -fi(\H)W) - \V)\B) basis. Due to the 
fact that |i/r> = -j=(\H)\V) - \V)\H}) is invariant under collec- 
tive unitary transformation, this scheme is insensitive to phase 
fluctuations from Alice's and Bob's interferometers. If the in- 
terval of the time between the two photons is just At p , Bob 
will successfully get Alice's qubit and this probability will be 
2/3 assuming the collective noise is totally random. Besides 
this, photons from the same pair can provide precise time ref- 
erences for each other. So in this scheme, accurate synchro- 
nization clock is unnecessary. 

BB84-type QKD protocols which are the most-widely used 
QKD protocol, needs single photon source which is not prac- 
tical for present technology. Usually, real-file QKD set- 
ups 0, H, HI [Till use attenuated laser pulses (weak co- 
herent states) instead. It means the laser source is equiva- 
lent to a one that emits n-photon state \n) with probability 
P„ = ^e' 11 , where yu is average photon number of the at- 
tenuated lased pulses. This photon number Poisson distri- 
bution stems from the coherent state | yfjie' 6 ) of laser pulse. 
Therefore, a few multi-photon events in the laser pulses emit- 
ted from Alice open the door of Photon-Number-Splitting 
attack (PNS attack) JH [H O which makes the whole 
QKD process insecure. Fortunately, decoy states QKD the- 
ory iQjtHtnlSIM], as a good solution to beat PNS attack, 
has been proposed. And some prototypes of decoy state QKD 
have been implemented lfl9i Efl I2H I22L I23I I24I EBll . The key 
point of decoy states QKD is to calculate the lower bound of 
counting rate of single-photon pulses (S \ ) and upper bound 
of quantum bit error rate (QBER) of bits generated by single- 
photon pulses (e j 7 )- Many methods to improve performance of 
decoy states QKD have been presented, including more decoy 
states [26], nonorthogonal decoy-state method i27ll . photon- 
number-resolving method [28], herald single photon source 
method ll29j[30ll . modified coherent state source method lf3~lTl . 
And for the intensity fluctuations of the laser pulses, Ref. 03411 
and 113511 give good solutions. 

As a BB84-type protocol, Boileau's scheme is still vulner- 
able to PNS attack. This problem will be discussed in details 
in the section II, in which we propose a novel type of PNS 
attack. In the Section III, we propose a decoy states method 
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to overcome this problem. In Section IV, a numerical simula- 
tion will be given. Finally, we will give a summary to end this 
paper. 

II. PNS ATTACK IN BOILEAU'S SCHEME 

To implement Boileau's scheme, an ideal two-photon states 
source which is far from present technology, is needed. In 
practice, two-photon states are generated by parametric down- 
conversion source(PDCS), which will emit n-photon (n > 1) 
pairs with certain probability. However, the state from a type- 
II PDCS can be written like (Q: 



| V > = (cosher 2 ^ V^TT e ''" e tanh"^|(D„>, 
in which, |(D„) is the state of n-photon pair, given by: 

- m, m) a \m, n — m) b 



\o H ) = -L= V(-ir> 



(1) 



(2) 



Here, \n,m) a(b) - \H )®" b \ V>® ( ™ } , a, b means the two spatial 
output modes of PDCS respectively. By randomizing the 
phase 9 11511 . we can write the density matrix of the PDCS 
as p A = / (de/(27T))\y)(y\ = P n (A)\$„){® n \, where, P„(A) = 
(n + 1)A7(1 + A) n+2 , A = sinh 2 ^-, which is half of the aver- 
age number of photon pairs generated by one pumping pulse 
and could be adjusted by the intensity of the pumping pulsed. 
Therefore, PDCS is really just a photon-number states source 
emitting n-photon pairs |<I>„) with probability P n (A). For im- 
plementations that do not apply phase randomization, Eve 
may attack this QKD system more powerfully 13611 . There- 
fore, for simplicity we assume that Alice have applied phase 
randomization to her photon pairs. 

Here we focus on the attack to 2-photon pairs, because the 
2-photon pairs are dominant among the multi-photon pairs. 
For the practical implementation |6] by Pan, Alice delays b 
mode of the two spatial outputs of PDCS with At p . Then 
through phase-modulation by Pockel cells ^ 2-photon pairs 
states could be described in creation operators form like this: 

h> = ^= 2 vf - mV + a HtV + b + vfHf)\vacuum) 

|+) = -L=(Hfvf + 2H + a y + a H + h y + h + V? H + b 2 )\vacuum) 

|0) = J-(H; 2 v; 2 + 2iH aK H t V b ~ VfHf)\vacuum) 



2V3 

|1) = -L(// f | 2 y; 2 - liH^HlX - vfH + b 2 )\vacuum) 

(3) 

where, H^, H b , V*, and V b represent the creation operators 
for horizontal polarized photons in a mode, horizontal polar- 
ized photons in b mode, vertical polarized photons in a mode 
and vertical polarized photons in b mode. For simplicity, we 
assume Eve add a beam splitter (BS) to the both modes a and 
b and we name the two spatial mode of the output of the BS is 



1 and 2. Now Eve has 4 spatial-temporal modes al, a2, bl and 
b2, and creator operators for horizontal-polarized and vertical- 
polarized photons in these new modes are correlated to modes 
aandfeby//; = (1/ V2)(#+ -#+ 2 ), V fl + = (1/ V2)(V+ - V+), 

HI = (1/ V2)(#+ - ff+), and V + a = (1/ V2)(y+ - V+ ). Then 
Eve can post-select the states that each of modes al, bl a2 
and b2 has one and only one photon respectively. We should 
notice that: although through just one BS the probability of 
success of this post-selection is just 1/4, Eve may use many 
BSs to make sure that this probability will be close to 1. And 
states |-), |+), |0) and |1) will be transformed to: 



I-)' 



l+>' 



|0>' = 



|1>' = 



1 



2 V2 



«H al V bl - V al H bl )(H a2 V b2 - V a2 H b2 ) 

V a2 H bl )) 

{{H al V bx + V al H bl )(H a2 V b2 + V a2 H b2 ) 



2 V2 

+(H al V b2 -V al H b2 )(H a2 V bl 

1 



2 V2 



+(H al V b2 + V al H b2 )(H a2 V bl + V a2 H bl )) 
((H a iV bi + iV al H bl ){H a2 V h2 + iV a2 H b2 ) 



(4) 



1 



2 V2 



+(H al V b2 + iV al H b2 )(H a2 V bl + iV a2 H bl )) 
((H al V M - iV al H bl )(H a2 V b2 - iV a2 H b2 ) 



+(H al V b2 - iV al H b2 )(H a2 V bl - iV a2 H bl )) 



where H(V)x represents state vector \H(V))x for abbreviation 
and the same below. Then Eve could use a unitary transfor- 
mation a i/\ to the photons in modes al and b2. The definition 
of ^1 is given by %HVE = HVE U %VHE = VHE U 
%HHE = HHE 2 and %VVE = VVE 2 , in which E x is 
an assist state of Eve and satisfying (£'o|£ , 1 ) = (Eq\E 2 ) = 
{E\\E 2 ) = 0. Eve post-select E\ through projection Pi = 
\E\ ){E\ I and then the four states will be mapped into the below 
states with probability 75%. 



|->" = -=(2|X> - \Y)) 
V5 



(5) 



|+>" = -p(2|X> + \Y)) 
V5 

lo>" = -L(2\x') + i\r» 

V5 

ID" = -^(2\X'} + i\Y}) 
V5 



where, |X> = (1/ ^)(H ai V bl H a2 V b2 + V a iH bl V a2 H b2 ), 
|F) = (l/^2)(H al H bl V a2 V b2 + V al V bl H a2 H b2 ) and \X') = 
(l/^j2)(H a ,V bl H a2 V b2 - V al H bl V a2 H b2 ). Now, Eve can 
construct another unitary transformation % defined by: 
%,\X)\Eo) = (V3|Z)|£!) + \X)\E 2 ))/2, W 2 \X')\E ) = 
( V3|Z)|£ 3 ) + \X')\E 2 ))/2 and W 2 \Y)\E ) = \Y)\E 2 ). Here, |£> 
represents an assist states of Eve and {Eq\Ei) = (Eq\E 2 ) = 
{Ei\Ei) = 0. And |Z) is any states of photon in modes al, bl, 
a.2 and b2. With ^2 and projection operation P 2 = \E 2 )(E 2 \, 
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the four photon states will be mapped to the followed form 
with probability 40%. 



I-)'" = — (|X>-|7» 
V2 

= —=(H a iVb2 - V a iH b2 )—-(H a2 V b i - V a2 H b \) 
V2 V2 

1+)'" = -Ul*> + l y » 
V2 

= -^{H al V bl + V al H b2 )^-(H a2 V bl + V a2 H bl ) 
1 



(6) 



|o>"' = — (ix> + i\r» 

V2 

= -^{H al V bl + iV al H b2 )-^-(H a2 V bl + iV a2 H bl ) 
V2 V2 

ID'" = -U|x>-*'|r» 

V2 

= -4=(fl«iVM - iV al H b2 )-^-(H a2 V bl - iV a2 H bl ) 

Obviously, with the states |->"', |+>"', |0)"' and Eve can 
keep one pair and send the other pair to Bob through a special 
channel controlled by herself. When Alice and Bob do basis 
reconciliation, Eve will get all secret information. This is just 
the same as PNS attack M [H [H . 

Let us review our attack strategy. First, Eve divides the 
two photons in modes a and b into modes a\, a2 and b\,b2 
respectively. With many BSs, success probability of this step 
is close to 1 . Second, Eve applys unitary transformation 
and projection P\, she gets an intermediate state with success 
probability 75%. Finally, She applys unitary transformation 
"^2 and projection P 2 , she gets the final state which she can 
launch PNS attack immediately and success probability of this 
step is 40%. Overall, for 2-photon pairs Eve will launch PNS 
attack with probability of 75% x 40% = 30% or discard a 
failure case with probability 1 - 30% = 70%. 

According to the above fact and the discussion of Ref. 
ifl^flslfTill . we know the security distance (L) of this scheme 
must obey Pi(A)(10- kL/m ) 2 > P 2 (A) x 30% in which k is the 
transmission fiber loss Constance. If we assumed = Q.2dB/km 
which is a typical value of this Constance and A — 0.1, we ob- 
tain L ^ 31Akm. This is a highly unsatisfactory situation. 
How to prolong the security distance is what we will discuss 
in the next section. 



III. DECOY STATES TO BOILEAU'S SCHEME 

The rate of secret key bits {R) for BB84 protocol with non- 
ideal source can be determined by GLLP 13311 : 



rate for the photon pairs, A is half of the average number of 
the photon pairs, /(Ea) is error correction efficiency, E\ is the 
quantum bit error rate (QBER) of the key bit, H 2 is the binary 
Shannon information function, S i is the counting rate for the 
1 -photon pairs, and e\ is the QBER of the key bits generated 
by the 1 -photon pairs. Similar to BB84 based on weak coher- 
ent states, we need to modulate A to several values randomly. 
Through watching counting rates for different A, we can ob- 
tain the lower bound of Si (S^) and the upper bound of e\ 
(e^ 7 ). Finally, R L can be obtained by equation (7). 

Our 3-intensity protocol is: Alice randomly emits photon 
pairs of density matrix px, p A ', and (A for signal states , A' 
{A > A') and for decoy states) , then Bob can get their count- 
ing rates Qa, Qx and So. With formulas we derived later, S^ 
and e v x can be obtained. Finally, R L is given by equation (7). 
Now we drive these formulas. 

The counting rates for the two intensity (A and A') photon 
pairs is determined by: 



n=0 



Qx =Y J P n (A')S n 

n=0 



(8) 



(9) 



where, S „ represents the counting rate for n-photon pair states 
|0>„>. Then QBER for the A (E A ) is determined by: 



EaQa = ^ j e n P n {A)S n 



(10) 



In which, e n is the QBER of the key bits generated by the 
n-photon pairs |0„). Before the derivation of the formula to 
calculate S \ and e u x , we prove that §^P n (A') < P„(A) for all 
of n > 2. 



P 2 (A) P 2 (A') 
P n (A) P n (A') 

= ^-((1 + V 2 -(l + i)"- 2 ) <0 
n + 1 A A' 



(11) 



With this result, we can deduce the formula for calculating 



Qa = Po(A)S + Pi(A)Si + P 2 (A)S 2 + P 3 (A)S 3 + ■■■ 

Pitt) , (12) 

> Po(A)S + PdW i + J] Pntt')S n 



,1=2 



With equation (9), we have: 
, L _ (P 2 (A')P (A) - P 2 (A)P Q (A'))So + Pi(A)Qai - Pi(A')Qa 



P 2 tt)Pitt') ~ Pitt')Pitt) 



R>R L = q[-QAf(E A )H 2 (E A ) + Pi(A)S^(l - H 2 (ef))] (7) According to equation (10) and UM, e\ can be given by: 



(13) 



Here, R L represents the lower bound of R, q depends on pro- 
tocol (1/2 for Boileau's scheme), Qa is the overall counting 



U _ {EaUa J > 



Pitt)S\ 



(14) 
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With equation (13) and (14), S x and e u x can be obtained. 
Finally, R L is given by equation (7). 

For experiment, 2-intensity decoy states protocol is quite 
convenient 12511 . In this case, Alice randomly emits photon 
pairs of density matrix px for signal states, p % for decoy states, 
then Bob can get their counting rates Q\, Qa> . We now deduce 
the formula to calculate Sj and e v x just from Qa, Qr- 

According to equation (10), the upper bound of So (Sn) can 
be given by: 



2E A Q A 



(15) 



Then from equation (10), S x for two-intensity case can be 
given by: 



si 

_ 2(P 2 U')P (A) - P 2 (A)P (A'))§^ + P 2 {X)Qx - Pi{X)Q» 
~ (P 2 (A)P 1 (A') ~ P 2 (A')P 1 (A))P (A) 

(16) 

To get e u x for two intensity case, we just set lower bound of S o 
(Sq) to be 0, then with equation (10) and (16), e v . is given by: 



EaQa 



(17) 



Equations (16) and (17) are for 2-intensity case. With these 
equations, we have established the basic methods to beat PNS 
attack in Boileau's QKD scheme. Next, we will make sure 
that this decoy states method can improve the performance of 
Boileau's QKD scheme impressively. 



IV. IMPROVEMENT BY DECOY STATES 

Now, we will show the improvement for the performance 
by the introduction of decoy states through the numerical sim- 
ulations. In the followed discussions and simulations, we ne- 
glect the error induced by channel and assume Bob's mea- 
surements are perfect except a few dark counts for simplic- 
ity. According to Ref. [6], Bob's measurement is equiva- 
lent to the projection to the polarization states F and S de- 
fined by H = (F + S)/ V2 and V = (F - S)/ V2 respec- 
tively. We rewrite the encoding states |+) and |-) in the 



form of F and S: |+> = -t-Z^i- 



n en- m c r 



l-> = 



VM+1 



V' 7 ( 1 W J7I1 -in c ' 



F b S a 



\ynpn-m S ,, 

For Bob, if he ob- 



servers the F a S b or S a Fb, it's will be |+) while the F a Ft, or 
S a S b is for the result of |+). According to Ref. llal . the trans- 
mission efficiency for the n-photon pulses r\ n can be written 
as T}„ — 1 - (1 - rf)", in which 77 is the transmission efficiency 
of the fiber channel and 77 = l0 ( -~ kL / 10 \ K is the transmission 
fiber loss Constance and L is the fiber length. Since our goal is 
to show the difference between the original Boileau's scheme 
and this scheme with decoy states but not the exact R L verse 
fiber length, we take the efficiency of the detector and loss due 
to projection to the DFS space or other causes just as a part of 



fiber loss and don't care these values. We assume the dark 
counting rates of the detectors is D. Since Bob must neglect 
all the three or four folds counts, S„ can be written as: 



S„ = (1 D ^ V ((r]n- m ( 1 - VT + " r]) n -' n ) 
n + 1 



2 " 



—m\2 



m=0 

+ 4// n _ m (l - 7,) m (l - vfD + 4r, m (l - 77)" '"(1 - rj) n D 
+ 4(1 -r]) 2n D 2 ) 

(18) 

Then with equation (8), we can get the formulas to estimate 
the Q A and Q^. 



Qa = Y,P„(A)S„ 



2(1 - D) 2 



(19) 



(1+ ^77(3 - 77) + A 2 rj 2 (2-rj)) 2 
(4At)D(1 - 77XI + Arf) + 2D 2 (1 + Arf) 2 
+ Ar] 2 (l + A 2 (2 - 77)77 + Aii] 2 - 277 + 3))) 

For simplicity we neglect the probability that a survived 
photon hitting a wrong detector, then e„ is written like: 

n 

e n S„ = [£(277 n _ m (l - 77)'"(1 - 7 7 )"-" , 77 m + 2^1 - 77)" m (l - rj) n D 



+ 277„_ m (l - rj) m {\ - rjfD + (1 - 77) 2 "2D] 



, d-g) 2 
n + 1 



(20) 

in which, the first term of the summation corresponds to the 
case of the photons in modes a and b both hitting the detec- 
tors. Only when n > 2, this term does not equal to 0. The 
second and third terms in above summation represent to the 
case photons in only one mode (a or b) hit the detector. The 
dark count of one detector may result in QBER in this situa- 
tion. The last term of the summation is for the case of all the 
photons are absorded by fiber. 

With this, we can estimate the QBER E A as: 



E x = Y I Pn(X)e n SJQA 

n=0 



= (D + ADtj + Atj(1 - tj)) z X 
[4ADtj(1 - rf)(l + Ar]) + 2D 2 (l + At]) 2 



(21) 



■Ar] 2 (l +A 2 t]{2 



77) + ^(77 2 - 277 + 3))]" 



Now with equations (19) and (21) and setting k = Q.2dB/km, 
D = 10- 6 / pulse, and f(E A ) = 1.2, the Q A , Qa>, E a can be cal- 
culated by numerical simulations. Then with equations (13) 
and (14), the 5^ and e u x can be obtained. Finally, the relation 
between R L and fiber length L can be get. And the results are 
depicted in Fig. 1. In Fig. 1, the solid curve is for the case that 
no decoy states is employed. In this case, for the calculation 
of Sf and e v . we have to assume that S„ = 1(t? > 2) and with 
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equation (15), then obviously the S \ is given by: 

PiW) (22) 

= Q A (l-2E A )-(l-P (A)-P 1 (A)) 
Pitt) 

The e^ 7 is then calculated by equation (14). With this method, 



R L is obtained by equation (7). From Fig. 1, we found that the 
3 -intensity decoy states method can improve the performance 
of Boileau's scheme dramatically. The longest security dis- 
tance in original Boileau's scheme is about 18 km while this 
distance for 3-intensity decoy states method will be 40 km. 
This improvement means about the 4.4dB increase in longest 
security distance. 
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FIG. 1: Lower bound of secret bit generation rate verse fiber 
length L. Solid curve: no decoy states is employed, Alice just emits 
PDCS with half average number of photon pair A = 0.1. Dashed 
curve: for the 3-intensity case, Alice randomly used PDCS with half 
average number of photon pair A = 0.1, A' = 0.01 and 0. 



V. CONCLUSION 

According to above discussions, we proved that through the 
introduction of decoy states method, especially the 3-intensity 
decoy states, the performance of Boileau's DFS type QKD 
would be dramatically improved. Thanks to 3-intensity decoy 
state protocol the increase of longest security distance can be 
4.4dB. This increase relays on the ability of 3-intensity de- 
coy states protocol can obtain a tighter bound of and e v x . 
Furthermore one can estimate the information leaked to Eve 
with high precision and higher key bit rate and longer security 
distance can be obtained. We hope that our protocol could be 
implemented soon. 
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